The use of a token, an inanimate object which confers a capability to the buyer presenting it, is pervasive in today's financial world. Whether a consumer is buying groceries with a debit card or shopping in a department store with a credit card, at the heart of that transaction is a money transfer enabled by a token, which acts to identify both the consumer as well as the financial account being accessed.
From their inception in the late 1950s, token-based financial transactions have grown increasingly more prevalent at the point of sale. However, as token-based transfers have become more popular with consumers, they have also become more popular with criminals intent on fraud. Currently, fraud losses in the industry stem from many different areas, but they are mainly either lost, stolen, or counterfeit cards.
Credit cards operate without the use of a personal identification number (PIN). This means that a lost credit card can easily be turned into cash if the card falls into the wrong hands. While theft of a token constitutes the majority of fraud in the system, fraud from counterfeit credit cards is rising rapidly. Counterfeit credit cards are manufactured by a more technically sophisticated criminal who acquires a cardholder's valid account number, produces a valid-looking counterfeit card, encodes the magnetic strip, and embosses the counterfeit plastic card with the account number. The card is then repeatedly presented to merchants until the account's credit limit is reached. Another form of loss is caused by a criminal seller or his employees who surreptitiously obtains the cardholder's account number and enter fictitious transactions against the card and then take cash out of the till. It is estimated that losses due to all types of fraud exceeds one billion dollars annually.
Generally, debit cards are used in conjunction with a personal identification number (PIN). Lost debit cards do not generally result in fraud, unless the owner of the card wrote his PIN on the card. Furthermore, successfully counterfeiting a debit card is more difficult than with a credit card, since the criminal must acquire not only the account number, but also the PIN, and then manufacture the card as in the credit card example. However, various strategies have been used to obtain PINs from unwary cardholders; these range from Trojan horse automated teller machines (ATMs) in shopping malls that dispense cash but record the PIN, to fraudulent seller point of sale devices that also record the PIN, to criminals with binoculars that watch cardholders enter PINs at ATMs. The subsequently manufactured counterfeit debit cards are then used in various ATM machines until the unlucky account is emptied.
Customer fraud, for both credit and debit cards, is also on the rise. Customers intent on this sort of fraud will claim that they lost their card, say that their PIN was written on the card, and then withdraw money from their account using card, and then refuse to be responsible for the loss. The financial industry is well aware of the trends in fraud, and is constantly taking steps to improve the security of the card. However, the linkage between the buyer and his token is tenuous, and that is the fundamental reason behind card fraud today
One possible solution to stolen-card fraud involves placing PIN protection for magnetic stripe credit cards, much as debit cards have PINs today. This will raise the administrative costs for each card, since cardholders will undoubtedly wish to select their own PIN for each of their 3.4 cards. In addition, this solution still doesn't address the problem of counterfeit cards.
Another solution that solves both stolen-card fraud and greatly reduces counterfeit-card fraud involves using a smartcard that includes either a biometric or a PIN. In this approach, authenticated biometrics are recorded from a user of known identity and stored for future reference on a token. In every subsequent access attempt, the user is required to physically enter the requested biometric, which is then compared to the authenticated biometric on the token to determine if the two match in order to verify user identity.
Various biometrics have been suggested, such as fingerprints, hand prints, voice prints, retinal images, handwriting samples and the like. However, because the biometrics are generally stored in electronic (and thus reproducible) form on a token and because the comparison and verification process is not isolated from the hardware and software directly used by the buyer attempting access, a significant risk of fraud still exists. Examples of this approach to system security are described in U.S. Pat. Nos. 4,821,118 to Lafreniere; 4,993,068 to Piosenka et al.; 4,995,086 to Lilley et al.; 5,054,089 to Uchida et al.; 5,095,194 to Barbanell; 5,109,427 to Yang; 5,109,428 to Igaki et al.; 5,144,680 to Kobayashi et al.; 5,146,102 to Higuchi et al.; 5,180,901 to Hiramatsu; 5,210,588 to Lee; 5,210,797 to Usui et al.; 5,222,152 to Fishbine et al.; 5,230,025 to Fishbine et al.; 5,241,606 to Horie; 5,265,162 to Bush et al.; 5,321,242 to Heath, Jr.; 5,325,442 to Knapp; 5,351,303 to Willmore, all of which are incorporated herein by reference.
An example of another token-based biometric smartcard system can be found in U.S. Pat. No. 5,280,527 to Gullman et al. In Gullman's system, the user must carry and present a credit card sized token (referred to as a biometric security apparatus) containing a microchip in which is recorded characteristics of the authorized user's voice. In order to initiate the access procedure, the user must insert the token into a terminal such as an ATM, and then speak into the terminal to provide a biometric sample for comparison with an authenticated sample stored in the microchip of the presented token. If a match is found, the remote terminal signals the host computer that the transaction should be permitted, or may prompt the user for an additional code, such as a PIN which is also stored on the token, before authorizing the transaction.
Although Gullman's reliance of comparison biometrics reduces the risk of unauthorized access as compared to PIN codes, Gullman's use of the token as the repository for the authenticating data combined with Gullman's failure to isolate the identity verification process from the possibility of tampering greatly diminishes any improvement to fraud resistance resulting from the replacement of a numeric code with a biometric. Further, the system remains inconvenient to the consumer because it too requires the presentation of a token in order to authorize a transaction.
Uniformly, the above patents that disclose commercial transaction systems teach away from biometric recognition without the use of tokens. Reasons cited for such teachings range from storage requirements for biometric recognition systems to significant time lapses in identification of a large number of individuals, even for the most powerful computers.
Unfortunately, any smartcard-based system will cost significantly more than the current magnetic stripe card systems currently in place. A PIN smartcard costs perhaps $3, and a biometric smartcard will cost $5. In addition, each point of sale station would need a smartcard reader, and if biometrics are required, a biometric scanner will also have to be attached to the reader as well. With 120 million cardholders and 5 million stations, the initial conversion cost is from two to five times greater than the current annual fraud losses.
This large price tag has forced the industry to look for new ways of using the power in the smartcard in addition to simple commercial transaction. It is envisioned that in addition to storing credit and debit account numbers and biometric or PIN authentication information, smart cards may also store phone numbers, frequent flyer miles, coupons obtained from stores, a transaction history, electronic cash usable at tollbooths and on public transit systems, as well as the buyer's name, vital statistics, and perhaps even medical records.
The net result of "smartening" the token is centralization of function. This looks good during design, but in actual use results in increased vulnerability for the consumer. Given the number of functions that the smartcard will be performing, the loss or damage of this monster card will be excruciatingly inconvenient for the cardholder. Being without such a card will financially incapacitate the cardholder until it is replaced. Additionally, losing a card full of electronic cash will also result in a real financial loss as well.
Thus, after spending vast sums of money, the resulting system will definitely be more secure, but will result in heavier and heavier penalties on the consumer for destruction or loss of the card.
To date, the consumer financial transaction industry has had a simple equation to balance: in order to reduce fraud, the cost of the card must increase. As a result, there has long been a need for a commercial transaction system that is highly fraud-resistant, practical, convenient for the consumer, and yet cost-effective to deploy.
There is also a need for a commercial transaction system that uses a strong link to the person being identified, as opposed to merely verifying a buyer's possession of any physical objects that can be freely transferred. This will result in a dramatic decrease in fraud, as only the buyer can authorize a transaction.
A further need in a commercial transaction system is ensuring consumer convenience by providing authorization without forcing the consumer to possess, carry, and present one or more proprietary objects in order to authorize a transaction. All parties intent on fighting fraud recognize that any system that solves the fraud problem must take the issue of convenience into account, however the fundamental yet unrecognized truth of the situation is, the card itself can be very inconvenient for the consumer. This may not be initially obvious, but anyone who has lost, left at home, or had a card stolen knows well the keenly and immediately-felt inconvenience during the card's absence.
Yet another need in the industry is for a transaction system that greatly reduces or eliminates the need to memorize multiple or cumbersome codes. Such a system must allow a user to access all of his accounts, procure all services to which he is entitled, and carry out transactions in and between all financial accounts, make point of purchase payments, etc.
There is further a need for a commercial transaction system that affords a consumer the ability to alert authorities that a third party is coercing the transaction without the third party being aware that an alert has been generated. There is also a need for a system that is nevertheless able to effect, unknown to the coercing third party, temporary restrictions on the types and amounts of transactions that can be undertaken.
Lastly, such a system must be affordable and flexible enough to be operatively compatible with existing networks having a variety of electronic transaction devices and system configurations.